Docker PHP Images Have PHP2Shell Fixes Ready to Deploy

The PHP patches are ready to deploy in Docker Official Images and Docker Hardened Images. If your application uses an affected PHP image or package, update its runtime immediately. Docker’s security update identifies PHP itself as the source of the vulnerabilities—not Docker’s systems. That distinction matters to the deployment. I’d change the PHP runtime serving the application, not upgrade Docker Engine and call the work done.

Docker began tracking the vulnerabilities on October 20, 2026. The affected releases reach back to PHP 5.4. Supported branches are in scope. So are older installations that no longer receive support; being outside the supported release list does not put an installation outside this update.

Which Docker PHP workloads need the update?

Start with the containers serving web requests through an affected PHP runtime, whether PHP came with the base image or was installed as a package. Check both routes. PHP’s advisory explicitly names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

PHP ranks mod_php as the highest-risk configuration: a demonstrated exploit allows an unauthenticated request to trigger the attack before application code runs. I’d update those deployments first. But first does not mean only. I would not use that ranking to justify leaving PHP-FPM or the other affected runtimes waiting for a later update.

PHP outside containers has the same vulnerabilities. A workload without PHP does not. I would not schedule a Docker upgrade for a non-PHP workload solely because of this advisory; I’d find the PHP runtime that actually handles requests. “Does this service use Docker?” is not the dependency check that answers whether it needs this fix.

PHP2Shell exploits request cleanup and stale worker state

The PHP2Shell vulnerabilities are memory-management flaws in PHP core that can allow unauthenticated remote code execution. They affect different parts of the request lifecycle. Keep that distinction in view when choosing mitigations: sharing a runtime does not mean the flaws share a workaround. Only an update provides a complete solution for both vulnerabilities.

CVE-2026-109618 concerns out-of-memory handling. An allocation failure can interrupt PHP while internal request data is only partly initialized, after which cleanup treats that invalid data as valid. Cleanup is part of the attack path. Looking only at the request’s normal execution path misses the vulnerable behaviour that cleanup itself can reach.

CVE-2026-109619 concerns request-owned state that survives its backing memory. A later request on the same worker can use that stale state before normal initialization resets it. The problem crosses request boundaries. That is why the advisory’s temporary settings require restarting every worker, not just changing configuration and assuming the workers already running are clean.

Patched Docker PHP images are already published

The updated Docker Official Images are on Docker Hub and mirrored to Amazon ECR. Docker Hardened Images are updated on Docker Hub too. For the supported PHP branches, these are the previous DHI versions and their patched replacements:

PHP also accepts later releases in the corresponding branches. Docker says it tested, verified and released its image updates within 24 hours of the upstream patches becoming available. The images are published. That is the extent of what this establishes; it does not tell you which PHP runtime your deployed application is actually using to serve requests.

PHP 8.1 and older no longer receive updates from the PHP project, though some distributions and LTS vendors provide backported fixes. PHP’s security team also supplied minimal source-backports for PHP 7.4, 8.0 and 8.1, intended for source builders or users without an LTS vendor. I’d keep those update routes distinct from the supported releases in the table. They are not the same release path.

Replace the PHP runtime that serves requests

My rollout gate would be the runtime serving requests. Not the registry. For a vendor-backported package, I’d require the vendor to confirm that it contains the fix; comparing its version number with upstream version numbers does not establish that. The check needs to match the update route you actually use.

1. Locate PHP in each application deployment. I’d inspect both the base-image reference and the installed PHP packages. Then I’d identify which runtime actually handles the application’s web requests, rather than stop at finding PHP somewhere in the deployment.
2. Select the patched release or confirmed backport. Use the matching supported branch in the table. If PHP comes from a distribution or LTS package, get that vendor’s explicit confirmation that the package fixes these vulnerabilities. A version comparison alone is not that confirmation.
3. Rebuild or replace the application image. Change the PHP dependency in the artifact that will actually be deployed. I would not mark the application update complete because a patched image appeared in a registry; the application artifact still needs the change.
4. Replace the serving deployment and verify its runtime. I’d check every serving instance to confirm that the intended patched package or image reached it. While making the change, I’d also watch request failures, worker restarts and memory pressure.
5. Keep a patched rollback candidate. I would reject a rollback that restores vulnerable PHP to service. If a branch migration breaks application compatibility, I’d prefer a vendor-confirmed fixed package where one is available. Without that option, I’d remove the service from exposure while resolving the migration.

The notice does not establish application compatibility when moving from an unsupported PHP branch to a supported one. I’d plan that as a migration. Assuming a drop-in patch is more than the notice supports. Docker directs customers with image-access or migration problems to Docker Support.

Temporary PHP settings do not make an unpatched container safe

Only an update is a complete solution. If you cannot update immediately, Docker recommends taking systems offline. PHP’s web-server mitigation guidance describes ways to reduce exposure in the meantime. I would treat them as exposure reduction, not as a reason to consider an unpatched runtime a safe substitute for a patched one.

Reducing PHP out-of-memory attack paths

For CVE-2026-109618, PHP recommends removing the controllable PHP memory-limit failure and reducing request sizes. The upload requirement determines which temporary values the advisory specifies. If the application does not accept file uploads, use these values:

memory_limit=-1
post_max_size = 8M

Put memory_limit=-1 somewhere the application cannot override it, such as php_admin_value in an FPM pool or Apache configuration. Then look for pool, directory or application settings that restore a finite limit. Check the overrides, not just the intended setting. Even then, an underlying allocation failure can still reach the vulnerable path; this does not close every route to the flaw.

If the application needs uploads, the advisory specifies post_max_size = 32M instead, with upload_max_filesize kept below post_max_size. It also recommends considering web-server or proxy limits on decoded request size, input field count, multipart part count, header count and nesting depth. I’d check those limits against requests without a usable Content-Length too. Those requests must be covered.

Use a container or cgroup limit as the availability boundary, preferably with a policy that kills only the affected worker. Keep that boundary outside PHP. Do not substitute RLIMIT_AS or RLIMIT_DATA: those limits can cause the allocation failure involved in the vulnerability. I would not make PHP’s memory limit unlimited without also reviewing the outer availability boundary that remains in place.

Blocking confirmed stale-state paths in PHP workers

For CVE-2026-109619, disabling upload-progress tracking blocks the confirmed session paths. Other variants remain. Apply the setting before request parsing through php.ini, an FPM pool or server configuration; the point at which the setting takes effect matters for this mitigation:

session.upload_progress.enabled=0

Restart every worker after changing the setting. All of them. I would not rely on either ini_set() or FPM .user.ini as the mechanism for applying this mitigation.

On PHP 8.5, also set fatal_error_backtraces=0 and then restart every worker. Keep the scope of that change clear: it blocks the confirmed fatal-backtrace path only, not the other paths.

Remove invalid or deprecated per-request settings that emit diagnostics before initialization. Hiding the diagnostics does not help, whether you use error_reporting, display_errors or @. The advisory also calls for fixing attacker-reachable fatal errors and execution timeouts. Check callbacks, upload or import processing, and cleanup for those failures.